VulnSocial

CVE-2026-82021Disclosure

LOWCVSS 9.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalog entry, with no further action required by the operator.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-494

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-08-30); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-08-30: 1Mentions · 2026-09-20: 1Patch / Workaround · 2026-09-20: 1Technical Details · 2026-08-30: 1Technical Details · 2026-09-20: 108-3009-20
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-08-301
Disclosure1
2026-09-201
Patch1
Full discourse2 posts
  • Light@白酒云@prolibertine
    Patch

    看了 CVE-2026-82021。Hermes Agent 0.18.2 到 0.19.0 之前那一档，自带 MCP catalog 里有些条目钉的是可变 branch，不是 40 位 commit SHA。上游仓库一旦被拿下，挪一下 branch tip，装过这条 catalog 的机器一起中招，操作员不用再点一次。CVSS 4.0 打到 9.0，CWE-494。 修复挺干脆：commit 9df5f879 起整本 catalog 强制精确 pin。git 装必须 40 位 SHA，uvx/npx 类要 pkg==X / pkg@X，裸名、范围、@latest 一律拒。n8n 那条还把 main 换成了具体 SHA。 装酒渠道 connector 时我其实踩过类似心态——Commerce7、ERP、一品一码扫码服务，图省事就跟 catalog 默认 ref 走。OAuth 能撤、grant 能收窄，这些白天聊过不少；可安装那一下如果钉的是 branch，后面权限模型再漂亮也白搭，因为跑的已经不是你以为的那份代码。 酒渠道里促销口径、发货州、会员续费、返点例外，全是会写单的 tool。catalog 安装这一步该跟依赖一样对待：SHA 钉死，升级另开变更，别把「能装上」当成「可信」。 对照今天前面写过的 Émile 远程 OAuth 可撤、Mem0/LiteLLM 的 connect≠grant：那些管连上之后能不能写；这条 CVE 管你连上的到底是不是你想连的那份。两层都要。 https://www.cve.org/CVERecord?id=CVE-2026-82021 https://github.com/NousResearch/hermes-agent/commit/9df5f879b4a5925c0f8f947e7e16ed8e845932c3

    Post summary

    The post explains CVE-2026-82021 in Hermes Agent, where mutable branch references in the MCP catalog enable supply chain code execution, and notes a fix via commit 9df5f879 that enforces exact SHA pinning.

    10010135
    578 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-82021 Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compro… https://www.cve.org/CVERecord?id=CVE-2026-82021

    Post summary

    The text announces a supply chain vulnerability in Hermes Agent 0.18.2 that permits remote code execution, but offers no proof of concept, exploit, or patch information.

    000111.7K
    58.0K followersView on X

Explore more

Back to dashboard